2019-04-07 19:20:24 +02:00
|
|
|
policy_module(sau, 0.1)
|
|
|
|
|
|
|
|
|
|
gen_require(`
|
|
|
|
|
type system_cronjob_t;
|
|
|
|
|
type sysadm_t;
|
|
|
|
|
|
|
|
|
|
role sysadm_r;
|
2019-04-07 19:36:12 +02:00
|
|
|
role system_r;
|
2019-04-07 19:20:24 +02:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
type sau_t;
|
|
|
|
|
type sau_exec_t;
|
|
|
|
|
type sau_config_t;
|
|
|
|
|
|
|
|
|
|
domain_type(sau_t)
|
|
|
|
|
domain_entry_file(sau_t, sau_exec_t)
|
|
|
|
|
files_config_file(sau_config_t)
|
|
|
|
|
read_files_pattern(sau_t, etc_t, sau_config_t);
|
|
|
|
|
|
|
|
|
|
role sysadm_r types sau_t;
|
|
|
|
|
role system_r types sau_t;
|
|
|
|
|
|
|
|
|
|
domain_auto_transition_pattern(sysadm_t, sau_exec_t, sau_t)
|
|
|
|
|
domain_auto_transition_pattern(system_cronjob_t, sau_exec_t, sau_t)
|
|
|
|
|
|
|
|
|
|
# this should be fixed, but I don't know enough selinux magic to restrict this
|
|
|
|
|
# while still allowing it to inspect all open files for all processes
|
|
|
|
|
unconfined_domain_noaudit(sau_t)
|
|
|
|
|
|
|
|
|
|
# Gentoo specific
|
|
|
|
|
portage_domtrans(sau_t)
|
|
|
|
|
|
2019-07-08 17:53:44 +02:00
|
|
|
|
|
|
|
|
# postfix
|
|
|
|
|
postfix_admin(sau_t, system_r)
|
|
|
|
|
|
